topic Re: Functionality - Mgmt API vs. SmartConsole - Revisited for R81.20/v1.9 in API / CLI Discussion

Functionality - Mgmt API vs. SmartConsole - Revisited for R81.20-v1.9 / R82-v2.0

Timothy_Hall — Fri, 04 Apr 2025 17:47:31 GMT

Several years ago I posted the article below (which has been updated along the way) asking what kinds of operations could not be executed via the management API and to be done manually in the SmartConsole:

Functionality - API vs. SmartConsole

I'd like to revisit this topic for R81.20/API v 1.9 for purposes of teaching an upcoming Check Point Certified Automation Specialist (CCAS) class. Here is my current list, however keep in mind that while some of these cannot be accessed directly through the API, one workaround is to use the run-script call to execute any command as a "one-time" script, which was added in API 1.9. In earlier releases one can do add repository-script then run-script script-name. Example of commands that could be run this way are cpstat and cplic.

So which ones am I missing for the latest API v1.9? Thanks!

Add/manipulate Content Awareness Data Types (resolved in R82 mgmt API v2.0)
SmartEvent Event Policy Tuning (performed in a separate GUI from SmartConsole). SmartEvent Views/Reports and the ability to schedule them are not available via API either.
SmartUpdate License/Contract Manipulation via API (performed in a separate GUI from SmartConsole prior to R80.40, but now available in SmartConsole) - (Licenses (not contracts) cab be manipulated via the API starting in version 1.9.1)
QoS Blade/Policies
GUIDBedit Operations (performed in a separate GUI from SmartConsole) Could use run-script call to execute dbedit operations as a "one-time" script, added in API 1.9. In earlier releases can do add repository-script then run-script script-name from the script repository.
Creation and Manipulation of LDAP Account Unit Objects
Creation and Manipulation of Legacy User@Host Objects (not Access Roles)
Creation and Manipulation of Legacy UFP/CVP Objects (which are deprecated in R80.x anyway)
Manipulation of Geo Policy (deprecated in R81, use Geo Updatable Objects which are fully supported via API).
Endpoint Policies
Not all properties under Global Properties...Advanced...Configure seem to be available via API. (resolved in R82 mgmt API v2.0)
Status & Traffic/System Counters report on Gateways & Servers tab (could use cpstat command via run-script to get some of this information)
Manipulation of Inspection Settings
Working with IPS ThreatCloud Protections & Core Activations
Manage & Settings...Blades Advanced Settings
Smart Tasks (can only show them, can't create or manipulate) (resolved in API v1.6)
Create/Manipulate UserChecks
Functions unique to the SmartView Monitor GUI:
1. SAM Rules
2. Alerting Thresholds
3. Live VPN Tunnel Views
Everything else that still has to be done by a administrator in the legacy SmartDashboard as of R81.20, namely:
1. Legacy Mobile Access Blade Configuration (resolved in R82 mgmt API v2.0)
2. Anti-spam & Mail Blade Configuration
3. DLP Blade (not Content Awareness)
4. Creation and Manipulation of External User Profiles (generic* user)
5. Various HTTPS Inspection configuration elements such as Trusted CAs and updating the list, and certificate validation settings. (resolved in R82 mgmt API v2.0)
Setting a service to use a Protocol Handler of None/Blank (thanks to @Bob_Zimmerman)
Creation and Manipulation of Log Exporter/SIEM server objects added in R81 & also Syslog server objects (thanks to @Bob_Zimmerman)
While gateway objects can be created and manipulated through the management API, not all gateway object settings are accessible via API. Examples: ISP Redundancy, Monitoring blade additional reports checkboxes, and Platform Hardware type.
Certain configuration elements of a VPN Community object such as IP Compression, Disable NAT inside the community, and Use aggressive mode cannot be set/viewed via the API (thanks to @Alex-).
VSX-related functions cannot be accessed at all through the Management API. (Ability to run vsx-provisioning-tool via API was added in R82 mgmt API v2.0)
Cannot create/manipulate APCL/URL bandwidth "Limit" objects. (resolved in R82 mgmt API v2.0)
Management API call get-interfaces does not support a Security Gateway object (SMO) that represents a Maestro Security Group or Scalable Platform, nor does the management API support creation/manipulation of Maestro Security Group objects. (resolved in R82 mgmt API v2.0)
Cannot view/manipulate CIFS resource objects. (resolved in R82 mgmt API v2.0)
Cannot view/manipulate third-party CA certificates utilized in VPNs among other places. (resolved in R82 mgmt API v2.0)

Am I missing anything? Thanks everyone!

Re: Functionality - Mgmt API vs. SmartConsole - Revisited for R81.20/v1.9

Bob_Zimmerman — Tue, 30 May 2023 18:34:08 GMT

SmartConsole can set a service object to use no protocol (special value None). The API can't.

Re: Functionality - Mgmt API vs. SmartConsole - Revisited for R81.20/v1.9

Timothy_Hall — Tue, 30 May 2023 18:39:25 GMT

Added to the list with credit, thanks!

Re: Functionality - Mgmt API vs. SmartConsole - Revisited for R81.20/v1.9

PhoneBoy — Wed, 31 May 2023 21:33:05 GMT

That’s a pretty complete list.
Might have to add this to my session I do on the API 🙂

Re: Functionality - Mgmt API vs. SmartConsole - Revisited for R81.20/v1.9

Bob_Zimmerman — Fri, 07 Jul 2023 13:18:21 GMT

I just learned about a whole new object type, apparently added in R81: Log Exporter/SIEM. It's a way to configure Log Exporter in SmartConsole.

Doesn't seem to be covered by the API at all.

Re: Functionality - Mgmt API vs. SmartConsole - Revisited for R81.20/v1.9

Timothy_Hall — Fri, 07 Jul 2023 13:30:09 GMT

Added to the list with credit, thanks!

Re: Functionality - Mgmt API vs. SmartConsole - Revisited for R81.20/v1.9

PhoneBoy — Sun, 09 Jul 2023 15:07:43 GMT

@Omer_Kleinstern can you confirm?

Re: Functionality - Mgmt API vs. SmartConsole - Revisited for R81.20/v1.9

Bob_Zimmerman — Sun, 09 Jul 2023 16:13:26 GMT

One minor correction to myself. Log Exporter/SIEM objects do show up in 'show objects', which is partial API coverage. I don't see a way to define new ones or edit existing ones via the API. None of the interesting fields show up as of API v1.8.1. I don't have an R81.20 system handy to test API v1.9 or v1.9.1:

[Expert@DallasSA]# mgmt_cli -f json -r true show object uid e2b2000b-8a07-4623-82b0-48ec3c7ae33d details-level full { "object" : { "uid" : "e2b2000b-8a07-4623-82b0-48ec3c7ae33d", "name" : "TestExporter", "type" : "LogExporter", "domain" : { "uid" : "41e821a0-3720-11e3-aa6e-0800200c9fde", "name" : "SMC User", "domain-type" : "domain" }, "color" : "black", "meta-info" : { "validation-state" : "ok", "last-modify-time" : { "posix" : 1688918286140, "iso-8601" : "2023-07-09T15:58+0000" }, "last-modifier" : "admin", "creation-time" : { "posix" : 1688918286140, "iso-8601" : "2023-07-09T15:58+0000" }, "creator" : "admin" }, "tags" : [ ], "icon" : "Objects/log_exporter", "comments" : "", "display-name" : "", "customFields" : null } }

Looking in that area of SmartConsole and comparing with the API documentation, the same is likely true for IF-MAP, Syslog, SecuRemote DNS, SecurID, Subordinate CA, and Trusted CA objects.

Re: Functionality - Mgmt API vs. SmartConsole - Revisited for R81.20/v1.9

Alex- — Mon, 14 Aug 2023 11:15:28 GMT

Advanced properties of a VPN community, namely IP Compression, Disable NAT inside the community and Use aggressive mode, can not be set or viewed with the API.

Re: Functionality - Mgmt API vs. SmartConsole - Revisited for R81.20-v1.9 / R82-v2.0

Daniel_Kuhl1 — Tue, 01 Apr 2025 14:23:13 GMT

Thanks for creating, sharing, and keeping it up to date. I'm walking through the Check Point Certified Automation Specialist (CCAS) - R81.20 course and this post is a really useful additional resource. 👍